Portugal’s whistleblowing law transposing the EU Directive was approved on December 20th, 2021 and has been in force since June 18th, 2022. The new national rules are an upgrade. Portugal went from having one of the weakest legal protections for whistleblowers in Europe to being one of the first to transpose the EU Directive. The Portuguese Whistleblower Protection Law (Law no. 93/2021) has introduced changes that are directly aligned with the EU Whistleblower Directive.
Who is a whistleblower under Portugal’s whistleblowing law?
Portugal’s whistleblowing law (Law no. 93/2021) defines a whistleblower as a person who reports or publicly discloses a breach based on information, they obtained through their work activities. The case of Rui Pinto suggests there was a need for more robust whistleblowing rules in the country. Pinto, the founder of Football Leaks, created a website to expose the European football industry’s tax avoidance schemes and unfair ownership models. In 2019, after a series of high-profile leaks that included the Luanda Leaks and Malta Files, the Portuguese whistleblower was arrested in Budapest on suspicion of extortion, violation of secrecy, and illegally accessing information.
At the time, Portuguese law contained special protection measures for a witness of a crime whose life, freedom, health, or property are in danger. It was unclear, however, whether Pinto fit the legal definition of a witness as he faced persecution by Portuguese authorities for his actions. The new Whistleblower Directive in Portugal marks a shift in the way these cases are handled, ensuring protection for whistleblowers in the private, public, and social sectors. Under the new rules, the definition of a whistleblower covers contractors, subcontractors, suppliers, service producers, and individuals under their supervision, as well as shareholders, volunteers, interns, and persons working in administrative or management roles such as advisory Boards.
Portugal’s whistleblower law expands the areas where witnesses of misconduct can be eligible for protection. It now applies to complaints related to public procurement, financial services, products and markets and the prevention of money laundering and terrorist financing, product safety and compliance, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health and consumer protection, and the protection of privacy and personal data by securing network and information systems. Any violation or omission (or attempts to conceal breaches) of European Union law rules in these matters can be reported as a breach under the new law.
Benefits of Portugal’s Whistleblower Law
In their book, Whistle-Blowing for Change, authors Tatiana Bazzichelli and Lieke Ploeger argue that “acts of whistleblowing are often made possible thanks to a mutual network of trust that gave the whistleblower the right courage.” They argue whistleblowing is fundamentally an act of social justice, and its process is embedded in national social-cultural and political systems. Perhaps this is why, according to Portugal’s whistleblowing law, only an individual who blows the whistle on misconduct ‘in good faith’ may benefit from whistleblower protection.
What legal protection do whistleblowers have? The new Portuguese whistleblower law protects employees who disclose wrongdoing by ensuring confidentiality, prohibiting retaliation, and providing supportive measures for whistleblowers who face litigation. As a strategy for avoiding retaliation against those who disclose misconduct, the new rules outlined in Law no. 93/2021 aim to protect the identity of whistleblowers by requiring companies to restrict access to reports and investigation materials to the persons responsible for receiving them and following up.
The whistleblower law in Portugal also prohibits retaliation against whistleblowers and imposes a ‘duty to compensate’ the person who experienced any retaliatory actions as a result of disclosing wrongdoing. One of the benefits of imposing this rule is that employees will be more likely to disclose fraud and other criminal offences when they see it. The new rules entitle the whistleblower to witness protection during criminal proceedings, something Pinto is now benefiting from.
Criticism of Portugal’s new Whistleblowing Law
Information ethics researchers, Bettina Berendt and Stefan Schiffner say that technology has long had a tradition of controversial societal debates. The EU Whistleblowing Directive and its transposition in Member States have raised several ethical and legal questions about the impact of the rules on businesses and democracy.
One of the key criticisms of Portugal’s Whistleblowing Law is that the whistleblower can only make an external report if:
- There is no internal channel in the workplace,
- The whistleblower is an employee,
- The breach cannot be resolved internally, or the disclosure cannot be received by the employer,
- The measures taken to resolve the complaint are not legally prescribed,
- There is a risk of retaliation,
- There is an imminent danger to the public,
- The mandatory time limits have not been respected by the employer, or
- The misconduct is a criminal or administrative offence punishable by a fine of more than 50,000 Euros.
These restrictions could potentially deter employees who don’t qualify for whistleblower rights and protections from disclosing information about risks to the public. It may also mean that smaller violations are not easily detected and rarely addressed internally, creating (or at minimum encouraging) a culture of non-compliance within the company or organisation. Whistleblower protection is most effective when organisations and businesses have the capacity to determine and manage risk, raise awareness about legal compliance issues and properly communicate those rules, train staff, and evaluate internal strategies.
How to Ensure Business Compliance
The new whistleblowing directive in Portugal comes with legal obligations for companies and public organisations. Under the new law, the creation of an internal legal channel is mandatory for entities with 50 or more employees. Companies covered by laws governing products and markets, the prevention of money laundering or terrorist financing, financial services, transport safety, and environmental protection must also comply with the Portuguese whistleblowing law.
The rules stipulate that companies with 50 to 249 employees can share resources with other entities to set up a channel for receiving and following up on reports of wrongdoing. All internal reporting channels must be confidential and avoid revealing the identity of the whistleblower or others mentioned in the report. The reporting channel must also align with other EU laws on personal data and ensure the deletion of any information not relevant to the reporting or investigation process.
Companies must notify the whistleblower that the report has been received and share any requirements or procedural information about external reporting options within seven days. An internal investigation must be conducted when a report is deemed a potential case for violation of laws. The company may also forward the report to a competent external authority for investigation and must inform the whistleblower of the measures taken to follow up on the report within three months of the initial filing. Within 15 days of concluding the investigation, the whistleblower must be informed of the outcome.
Under the new rules, failure to comply with these obligations is considered a serious offence and could lead to fines and a loss of reputation and public trust. This signals a new era in risk management and anti-corruption for businesses in Portugal and other EU Member States. Knowing how to communicate your new whistleblowing policy and encourage compliance will be key to implementing Portugal’s new whistleblower directive.
